Gigabit Ethernet multimode fiber optic backbone cables are being deployed to connect sections of high-speed networks together. To secure these high-speed networks, software based Intrusion Detection Systems (IDSs) have been introduced. These systems capture and analyze all packets for unusual patterns that point to an intrusion. However, this adds to the complexity of the network. Current IDSs are hampered by a Base-Rate Fallacy limitation, which is the inability to suppress false alarms. Additionally, software-based IDSs do not protect against passive optical fiber tapping, which can go undetected by the network hardware.
It is well known, by those skilled in the technology, that an optical fiber can easily be tapped and the data stream monitored. One relatively simple non-interruptive tapping method involves placing a bend coupler on the fiber to be tapped. A controlled bend of a critical radius is placed on the fiber. This causes a small spatial distortion in the core/cladding guiding properties and a fraction of the light escapes the fiber. A detector is located at the point of the light leakage and the data steam intercepted. Bend couplers typically introduce a loss of light power of up to 1 dB or more. Power measuring intrusion detection systems are available to detect this loss in optical power and provide warning alarms.
With care and skill, more insidious methods are available to the skilled intruder. With a sufficiently sensitive receiver and care in preparation, a fiber can be successfully tapped without introducing a telltale bend in the optical fiber. A successful tap can be achieved by carefully removing a short length, in the order of a few centimeters or inches of the protective outer coating of the target fiber and polishing the outer cladding down by a few microns to form a flat coupling region. A cladding-to-cladding coupling is then made using a special intercept fiber. This method intercepts a portion of the weak but measurable cladding mode power that propagates in the tapped fiber. In this case, the intercepted light, which may be detected by a sensitive receiver, can easily be 20 or 30 dB down from the power in the fiber core. This results in a loss of received optical power of only 0.04 or 0.004 dBm and is impossible to detect reliably by power measurement methods. The present invention addresses the limitations of current power loss detection methods and can detect intrusion activity before any optical power loss occurs.